CVE-2017-3881

Cisco IOS and IOS XE: Remote Code Execution

As of , CVE-2017-3881 in Cisco IOS and IOS XE is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 25 March 2022
US federal deadline
15 April 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.95 on 25 March 2022EPSS on the day CISA listed it.
Public exploit
1 Metasploit module and 2 Exploit-DB entries
Fix
No vendor link in CISA's entry

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.

CISA's description

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.

The CVE record's description, from cisco

CVE published
17 March 2017
Assigned by
cisco
CVSS
9.8 Critical (CVSS 3.1, from CISA-ADP)
CWE-20
Improper Input Validation
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. Exploit-DB published an exploit (EDB-ID 41872).
  3. Exploit-DB published an exploit (EDB-ID 42122).
  4. CISA added it to its list of exploited vulnerabilities.
  5. The US federal deadline to fix it.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

IOS and IOS XE: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2018-0171Software Smart Install Remote Code ExecutionCisco IOS and IOS XEPatch this weekEPSS 0.990.99
CVE-2025-20352Software SNMP Denial of Service and Remote Code ExecutionCisco IOS and IOS XEPatch soon0.39
CVE-2023-20109Group Encrypted Transport VPN Out-of-Bounds WriteCisco IOS and IOS XEPatch soon0.02

Read further